Malware Analysis Report

2025-08-06 03:48

Sample ID 221030-x8w82aggbr
Target ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
Tags
cybergate cryptosuite persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203

Threat Level: Known bad

The file ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203 was found to be: Known bad.

Malicious Activity Summary

cybergate cryptosuite persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-30 19:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-30 19:32

Reported

2022-10-31 12:26

Platform

win7-20220901-en

Max time kernel

150s

Max time network

136s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\java\upgrade\javaing.exe N/A
N/A N/A C:\Program Files (x86)\java\upgrade\javaing.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\ C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1056 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 1080 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

"C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe"

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

"C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe"

C:\Program Files (x86)\java\upgrade\javaing.exe

"C:\Program Files (x86)\java\upgrade\javaing.exe"

C:\Program Files (x86)\java\upgrade\javaing.exe

"C:\Program Files (x86)\java\upgrade\javaing.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 otocukk.no-ip.biz udp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
US 8.8.8.8:53 otocukk.no-ip.biz udp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp

Files

memory/1056-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

memory/1080-55-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-56-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-58-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-59-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-60-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-61-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-62-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-64-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-65-0x000000000040BBF0-mapping.dmp

memory/1056-67-0x0000000000240000-0x0000000000244000-memory.dmp

memory/1080-66-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-69-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-70-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1080-72-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1368-75-0x0000000024010000-0x0000000024072000-memory.dmp

memory/2024-78-0x0000000000000000-mapping.dmp

memory/2024-80-0x0000000075231000-0x0000000075233000-memory.dmp

memory/1080-81-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/2024-86-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 c49d7f49a566969a9a265397c768ca11
SHA1 695e4dff4e0bdfce5beb065415b30da38215cbd1
SHA256 2316df904c22a41779717e18353c63c2a29da1e2a0510cf470e5053ee76aaf11
SHA512 a9fa4563c70425fee750858626b95ceccebada781a8062390f12afe462286f699e7d4e45d7347039f96ea565c775eafac92551373a0c86273757ba23f9c4355b

memory/2024-89-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1080-91-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1180-95-0x0000000000000000-mapping.dmp

memory/1080-97-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1180-102-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1080-103-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1180-104-0x0000000024160000-0x00000000241C2000-memory.dmp

\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

memory/1804-106-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

memory/1180-110-0x0000000024160000-0x00000000241C2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-30 19:32

Reported

2022-10-31 12:26

Platform

win10v2004-20220901-en

Max time kernel

151s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\java\upgrade\javaing.exe N/A
N/A N/A C:\Program Files (x86)\java\upgrade\javaing.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaing = "C:\\Program Files (x86)\\java\\upgrade\\javaing.exe" C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\ C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\javaing.exe C:\Program Files (x86)\java\upgrade\javaing.exe N/A
File created C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
File opened for modification C:\Program Files (x86)\java\upgrade\javaing.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Program Files (x86)\java\upgrade\javaing.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 1724 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

"C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe"

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe

"C:\Users\Admin\AppData\Local\Temp\ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203.exe"

C:\Program Files (x86)\java\upgrade\javaing.exe

"C:\Program Files (x86)\java\upgrade\javaing.exe"

C:\Program Files (x86)\java\upgrade\javaing.exe

"C:\Program Files (x86)\java\upgrade\javaing.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5040 -ip 5040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 532

Network

Country Destination Domain Proto
US 8.8.8.8:53 otocukk.no-ip.biz udp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
FR 2.18.109.224:443 tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
IE 20.50.80.209:443 tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
US 8.8.8.8:53 otocukk.no-ip.biz udp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
US 8.8.8.8:53 otocukk.no-ip.biz udp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp
BG 78.159.131.80:443 otocukk.no-ip.biz tcp

Files

memory/3608-132-0x0000000000000000-mapping.dmp

memory/3608-134-0x0000000000400000-0x0000000000450000-memory.dmp

memory/3608-133-0x0000000000400000-0x0000000000450000-memory.dmp

memory/3608-135-0x0000000000400000-0x0000000000450000-memory.dmp

memory/1724-136-0x0000000002200000-0x0000000002204000-memory.dmp

memory/3608-137-0x0000000000400000-0x0000000000450000-memory.dmp

memory/3608-139-0x0000000024010000-0x0000000024072000-memory.dmp

memory/3344-143-0x0000000000000000-mapping.dmp

memory/3608-144-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3344-147-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 c49d7f49a566969a9a265397c768ca11
SHA1 695e4dff4e0bdfce5beb065415b30da38215cbd1
SHA256 2316df904c22a41779717e18353c63c2a29da1e2a0510cf470e5053ee76aaf11
SHA512 a9fa4563c70425fee750858626b95ceccebada781a8062390f12afe462286f699e7d4e45d7347039f96ea565c775eafac92551373a0c86273757ba23f9c4355b

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

memory/3344-150-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3608-152-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/5028-156-0x0000000000000000-mapping.dmp

memory/3608-157-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/3608-161-0x0000000000400000-0x0000000000450000-memory.dmp

memory/5028-160-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/5028-162-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/928-163-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

memory/5040-165-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\java\upgrade\javaing.exe

MD5 825a5d844ccae6f1176bcdb35c26e1c0
SHA1 f8fdb71e491d31a9ed09ad0879768d12f7d53d94
SHA256 ab89785ce8d745bb9dd2c8d23519ed1a4e503938d3a496d059f786219ae54203
SHA512 4f4cbd34fc3567f95cd87e283251eeb84ae1d665f90524961c41d39d45b3a78e98bc2a1c3fcf49a1137d66ee4b62673dfa87269553cabf2dd871c1c4be24ce0f

memory/5040-169-0x0000000000400000-0x0000000000450000-memory.dmp

memory/5040-170-0x0000000000400000-0x0000000000450000-memory.dmp

memory/5028-171-0x0000000024160000-0x00000000241C2000-memory.dmp